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ABSTRACT 

This paper describes the steps and procedures necessary to achieve a successful lightning-protection design for a state-of-the-art Full- 
Authority Digital Engine Control (FADEC) System. The engine and control systems used as examples in this paper are fictional, but the 
design and verification methods are real. Topics discussed include applicable airworthiness regulations, selection of equipment transient 
design and control levels for the engine/airframe and intra-engine segments of the system, the use of cable shields, terminal-protection 
devices and filter circuits in hardware protection design, and software approaches to minimize upset potential. Shield terminations, 
grounding and bonding are also discussed, as are the important elements of certification and test plans, and the roles of tests and analyses. 
The paper includes examples of multiple-stroke and multiple-burst testing. The paper concludes with a review of design pitfalls and 
challenges, and status of applicable test standardssuchasRTCADO-160, Section 22. This paper will be presented in two parts; Parti -Design, 
and Part II - Verification. 

1.0 INTRODUCTION 


Developed in the early 1970s formilitary aircraft, electronic- 
flight and engine-control systems have found increasing appli- 
cation in the commercial fleets of the world. Systems such as 
Full-Authority Digital Engine Control (FADEC) and Fly-By- 
Wire (FBW) not only perform flight-critical and essential 
functions, but do so independently of mechanical or hydraulic 
backup. Currently operating commercial transport aircraft such 
as the Airbus A320, McDonnell Douglas MD-1 1, and Boeing 
B747-400 me full-authority electronics for engine control and 
some aspects of flight control. Other systems are under devel- 
opment. 

Because FADEC and FBW systems are flight-critical, they 
are required by regulatory agencies to withstand the effects of 
a severe lightning strike to the aircraft. This paper describes and 
interprets the current airworthiness regulations and standards 
pertaining to lightning protection and provides a technical 
discussion of the steps that should be taken to achieve a 
successful protection design. This paper also reviews several 
design problems and ways to overcome them. Methods to verify 
adequacy of these designs are treated in a sequel paper [1], 

2.0 DESCRIPTION OF SYSTEMS 

Typical FADEC and FBW systems share many features that 
are important from a lightning-protection standpoint. In gen- 
eral, both types of systems are designed to convert pilot-input 
data, such as control stick or throttle-lever movement, into 
digital signals which are receivedby actuators at the appropriate 
engine controls or flight-control surfaces. 

Both types of systems have similar configurations: 

• The systems are widely distributed throughoutthe airframe, 
with controls in the cockpit electrically connected to actuators 
as far as the tail and wingtips. 

• FADEC and FBW systems usually receive electric power 
from the aircraft power distribution buses, which are also 
distributed throughout the aircraft. 

• The systems interface with cockpit displays, and often with 
general-purpose digital data buses. 

• The systems are sometimes connected to externally mounted 
sensors and actuators. 

Block diagrams of generic FBW and FADEC systems are 
shown in Figures 1 and 2. Figures 3 and 4 show typical locations 
of system components and interconnecting wiring within an 
aircraft and an engine, respectively. 

A full FBW system controls the three main axes of flight - 
pitch, roll and yaw - by adjusting ailerons, rudder, elevators, 
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flaps, trim-tabs, etc. For each of the pilot’s controls, the FBW 
system includes a force transducer that converts the pilot’s stick, 
pedal or lever motion into electrical signals. These signals are 
transmitted to a computerand voter unit (CVU) which reads not 
only all the data being suppliedby the pilot commands, but also 
data sent by aircraft motion sensors (including gyros and air- 
data probes) and control-surface position indicators. The CVU 
regularly consists of three ormore separate processors operating 
on separate channels, sometimes asynchronously. The voter 
unit polls the independent processors for agreement. 

This redundancy is a safety feature but it does not in itself 
provide adequate protection against lightning because ligntning- 
induced effects appear simultaneously in all channels of inter- 
connecting wiring and thus have the potential to damage 
components in all channels at once. 

The CVU computes the optimum changes to make in the 
various control-surface positions in order to accomplish the 
pilot’s commands and maintain pre-programmed flight param- 
eters. In addition to the above connections, the CVU is also 
connected to the pilot’s display panels and to the aircraft’s main 
power systems, including one or more engine-driven generators 
and one or more batteries. The computer sends the appropriate 
electronic signals to secondary actuators near the control sur- 
faces. 

The secondary actuators (SA) translate the electrical signals 
from the CVU to mechanical motion of the flight-control 
surface. The SA will typically consist of an electrically acti- 
vated servovalve to operate the hydraulically powered control- 
surface actuators. There are also differential transducers which 
provide the CVU and main cockpit display with feedback 
information on the position of the control surfaces. 

FADEC systems also include cockpit controls and interfaces 
with other cockpit avionics, as well as engine-mounted compo- 
nents, which usually include the electronic control unit (ECU) 
whose function is to that of the CVU in an FBW system. Usual ly, 
a FADEC system is comprised of two channels, designated A 
andB, at each engine. The CVU interfaces with engin-mounted 
sensors and actuators, and with cockpit avionics. The intercon- 
necting wire harnesses often follow different routes between 
engine and cockpit to protect the system against damage from 
an exploding engine, etc. This is referredto as disbursed routing. 
Instead of control surfaces, as found in FBW systems, FADEC 
systems typically control engine fuel flow, stator vane position, 
exhaust nozzle configuration, etc., to optimize engine perfor- 
mance and economy. 
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FIGURE 1 Typical FBW System 
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FIGURE 2 Typical FADEC Block Diagram 
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FIGURE 4 Engine Harnesses 


Both systems provide many challenges to the lightning- 
protection engineer. The amount and length of interconnecting 
wiring harnesses makes them susceptible to lightning indirect 
effects, and the location of some components near aircraft 
extremities results in potential susceptibility to direct lightning 
effects. The magnitudes of induced transients are difficult to 
predict because of the difficulty of describing most wiring 
installations in circuit or mathematical terms that can be 
analyzed. These complexities make numerical modeling of the 
waveforms and currents which might be expected in the systems 
very difficult. Mathematical analysis currently can predict only 
orders of magnitude, which are of use in formulating design 
goals but inadequate for verification of all but the simplest of 
systems. 

3.0 REGULATIONS 

Airworthiness certifying authorities around the world assume 
that during the operational life of an aircraft, lightnin g strikes will 
occur. Over the years, the Federal Aviation Administration (FAA) 
has developed several Federal Aviation Regulations (FAR) [2] 
which pertain to lightning. These are listed in Table I, and include 
FAR 25.581, which states, for transport category aircraft: “The 
airplane must be protected against catastrophic effects of lightning.” 
Of more particular interest to engineers concerned with electronic 
control systems is FAR 25 . 1 309 which requires that “The equipment, 
systems, and installations whose functioning is required by this 
subchapter, must be designed to ensure that they perform their 


intended functions under any foreseeable operating condition.” 
While not mentioned by name in this regulation, lightning is consid- 
ered a foreseeable operating condition. To preclude any question of 
the applicability of FAR 25.1309 to lightning protection, the FAA 
has required lightning protection of flight-critical and essential 
avionics through the imposition of special conditions and issue 
papers. A special condition is written by the FAA (or similar 
certifying authority in another country) expressly for a particular 
aircraft (or modification) and has the same force and effect as a 
published regulation. An issue paper delineates a safety issue of 
particular concern to the FAA, and requests the applicant to address 
this issue and respond to the FAA with details. Thus, an issue paper 
has somewhat less force than does a special condition. 

To avoid questions as to the applicability of FAR 25.1309 to 
lightning protection, the FAA will shortly issue FAR 25.1315, which 
is similar to 1309 but pertains specifically to protection of avionics 
against the effects of lightning. It is the first such regulation to be 
issued by the FAA, and will obviate the need for special conditions. 

This new regulation will define critical functions as those whose 
failure would contribute to or cause a condition which would prevent 
the continued safe flight and landing of the airplane. Critical func- 
tions must not be affected when exposed to lightning. Essential 
functions are those whose failure would contribute to or cause a 
condition which would significantly impact the safety of the aircraft 
or the ability of the flight crew to cope with adverse operating 
conditions. Essential functions must be protected to ensure that the 
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TABLE 1 U.S. Federal Aviation Regulations 

Vehicle Type 

and Regulations 



Aircraft 


Rotorcraft i 


General 

Aviation 

Transport 

Normal 

Transport 

Airframe 

.... 23.867 

25.581 

. . . 27.610 

. 29.610 

Fuel System . . 

.... 23.954 .. 

25.954 

... 27.954 

. 29.954 

Other Systems 
Avionics 

23.1309 

25.1309 

25.1315 

. . . 27.1309D 

. 29.1309H 


function can be recovered in a timely manner after being exposed to 
lightning. 

Neither FAR 25.1309 nor the forthcoming FAR 25.1315 define 
the lightning environment for design and certification purposes. This 
is found in FAA Advisory Circular 20-136 [3] which will be 
discussed in more detail later in this paper. 

Lightning protection requirements for general aviation aircraft 
and general and transport category rotocraft are included in Parts 23, 
27 and 29, respectively, of the U.S . Federal Aviation Regulations [4], 
[5], [6], The basic requirements are similar to those in Part 25, 
although application (and enforcement) of them to general aviation 
(Part 23) aircraft has not been as extensive. Lightning-protection 
regulations for rotocraft are also similar to the transport aircraft (Part 
25) requirements, and the recent introduction of FBW and FADEC 
systems to these vehicles has prompted renewed attention to the 
helicopter lightning-protection requirements. 

Military aircraft and rotorcraft must either comply with FAA 
standards or Mil-Stds 1757A and 1795A, depending on their role. 
MIL-STD-1795A describes the protection requirements and the 
lightning environment, and MIL-STD-1757A presents verification 
tests methods. Both are the same as the FAA requirements for civil 
aircraft. MIL-STD-1795A is ofinterest because it extends protection 
beyond flight-critical/essential systems to include those systems 
whose failure could endanger mission success, or result in excessive 
maintenance costs, on an optional basis. These mission and mainte- 
nance factors, of course, are ofequal concern to owners/operators of 
civil aircraft, but are not a part of the civil-airworthiness require- 
ments. 

Translation of these regulations into specific aircraft design goals 
is left to the manufacturer. However, in order to obtain certification, 
the manufacturer must verify that the aircraft and its systems are 
protected against catastrophic effects from lightning in accordance 
with these regulations. 

4.0 STANDARDS 

Beyond the regulations, the FAA has issued Advisory Circulars 
(AC) that provide more detailed information on how to achieve 
successful compliance with the FARs. The fust lightning-related AC 
was 20-53 [7] that dealt with lightning protection of fuel systems. 
However, the FAA recognized that this did not cover other systems, 
so in 1972 the Society of Automotive Engineers Committee on 
Electromagnetic Compatibility was asked to form a subcommittee to 
develop improved aircraft lightning-protection standards. This com- 
mittee was designated SAE AE-4L. 

Over the years, the committee issued several reports which did 
much to define the threats posed by lightning and to recommend 
design practices and test methods required to ensure protection. Of 
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particular importance to electronic control systems is the SAE 
Committee Report AE4L-87-3, called the Orange Book, which was 
adopted by the FAA in 1 990 as AC 20-136. The subject is “Protection 
of aircraft electrical/electronic systems against the indirect effects of 
lightning.” 

This AC defines the electrical characteristics of lightning for use 
in design and verification of protection against lightning indirect 
effects. This AC includes recent additions to the environment that are 
important to indirect-effects protection, including multiple strokes 
and multiple bursts which are described in [8]. In addition, AC 20- 
136 furnishes the engineer with procedural steps which can be 
followed to achieve and verify a successful design. These steps, as 
they apply to full-authority electronic control systems, are discussed 
in following sections of this paper. 

5.0 INDIRECT EFFECTS 

Since mostparts ofanFBW or FADEC systemare installed inside 
an airframe, lightning indirect effects are of primary concern. These 
effects have been described fully elsewhere [9], [10], [1 1], [12] and 
include voltages and currents induced by changing magnetic fields 
and/or structural voltages in the interconnecting wiring associated 
with FBW and FADEC systems. 

Of particular concern to digital systems is the potential for upset 
of data processing and control functions due to the effects of the 
multiple-stroke and burst environments. Whereas shielding and 
other protection approaches may control induced transients to non- 
damaging levels, the low-level transients that remain intermingle 
with them, resulting in erroneous commands. There will be as many 
transients as there are strokes or pulses in the “multiple” environ- 
ments, and these may change or upset computer-generated words and 
commands. In one well-documented case, a single additional bit 
induced by a lightning strike to an Atlas-Centaur rocket launched by 
NASA from Cape Canaveral resulted in a hard-over guidance 
command and loss of the vehicle shortly after liftoff [1 3]. 

6.0 DIRECT EFFECTS 

Electronic control systems may also be exposed to the direct 
attachment of the lightning channel to externally mounted sensors, 
such as air-data probes or actuator parts. Another concern is the 
puncture of non-conducting skins, resulting in direct lightning 
current flow into control system components. Direct effects may also 
be caused by lightning currents being transferred to the electronic 
systems via cables or power supplies shared with unrelated non- 
critical components such as antennae, probes or lights. It is the 
responsibility of the lightning-protection engineer to identify pos- 
sible current paths of direct entry of lightning currents to the system. 





7.0 STEPS IN DESIGN 

The most successful lightning-protection design programs occur 
when the process is conducted in a logical series of steps. As outlined 
in AC 20-136, the steps are: a) Determine the lightning strike zones, 
b) Establish the external lightning environment for the zones, c) 
Establish the interior environment, d) Identify the aircraft flight- 
critical/essential systems and equipment, e) Establish Transient 
Control Levels (TCL) and Equipment Transient Design Levels 
(ETDL). f) Design protection, g) Verify protection. The balance of 
this paper describes steps a through f. Step g is the subject of a sequel 
paper [1]. 

7.1 a) DETERMINE LIGHTNING- 
STRIKE ZONES 

There are five defined lightning-strike zones which are defined as 
follows: 1) Zone 1 A: Initial attachment point with low possibility of 
lightning channel hang-on. 2) Zone 1 B: Initial attachment point with 
high possibility of lightning channel hang-on. 3) Zone 2 A: A swept- 
stroke zone with low possibility of lightning channel hang-on. 4) 
Zone 2B: A swept-stroke zone with high possibility of lightning 
channel hang-on. 5) Zone 3: Those portions of the aircraft that lie 
with in or between the other zones, which may carry substantial 
amounts of electrical current by conduction between areas of direct 
or swept-stroke attachment points. 

The location of the zones varies from one aircraft design to 
another, and depends upon aircraft geometry and operational factors. 
Therefore individual assessments must be made for each aircraft. 
Methods of determination are described in [14], 

The lightning currents to be expected in each zone are shown in 
Table 2. 


TABLE 2 Current Components Applicable in Various 
Zones 
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Until recently. Zone 1A was identified as extending only 18 
inches aft of the leading edge extremities such as engine inlets. 
However, in-flight experience and laboratory tests ofscale models of 
aircraft have shown that Zone 1 A may be extended up to 6 meters aft 
of leading edges. Thus, most surfaces of wing-mounted nacelles are 
located within Zone 1 A and subject to the first return stroke, current 
component A. Trailing edges of engine nacelles and exhaust ducts 
are in Zone IB, where all four components of the lightning environ- 
ment are experienced. Flight-control surfaces have similar expo- 
sures, depending on their location on the aircraft. 

It must be remembered that structures and components inside 
surfaces in most zones are in Zone 3 and are exposed to the effects 
of conducted currents. Figure 5 shows typical zones on a wing- 



mounted engine nacelle. 

Once zones havebeen established for apaiticular aircraft design, 
they should be documented on a drawing of the vehicle with 
boundaries identified by appropriate station numbers or other 
notation. It is appropriate forthe applicant to review and obtain FAA 
concurrence for the zone drawings since these determine the spe- 
cific components of the lightning environment that the system must 
withstand. 

Of essential concern to the aircraft designer is the identification 
of the various zones and surface materials through which the flight- 
critical electronic control systems pass. This will aid in determining 
the direct and indirect effects to be expected and the protection 
methods required, as will be discussed later in this paper. 

7.2 b) ESTABLISHING THE 
EXTERNAL LIGHTNING 
ENVIRONMENT 

The results of recent research into characteristics of lightning 
encountered by aircraft has focused attention beyond the effects of 
cloud-to-earth lightning, to include the additional characteristics of 
intracloud and cloud-to-cloud lighting strikes, especially as they 
may affect electronic systems. Whereas the amplitude and action 
integrals of the currents in these strikes are usually less than those 
associated with cloud-to-earth flashes, other aspects, such as peak 
rates ofchange ofcurrent and multiplicity ofpulses, are ofparticular 
concern. 

The most significant of these results is the multiple-burst light- 
ning environment, composed of a large number of comparatively 
low amplitude pulses, characterized by high rates of change (up to 
2x10“ a/s) and short duration (between 1 and 10 microseconds), and 
occurring randomly over the lifetime of the lightning flash. 

Multiple-burst phenomenon is now added to the cloud-to-earth 
lightning environment which includes the four basic current compo- 
nents and the multiple-stroke environment based on components A 
and D/2, as follows: 

Component A: Initial High Peak Current Component B: Inter- 
mediate Current Component C: Continuing Current Component D: 
Restrike Current Multiple Stroke (Component A, followed by 23 
Components D/2) 

The multiple-burst environment, or Component H, as described 
in AC 20-136 Appendix III, has a peak current of 1 0 kA and a peak 
rate of rise of 2x10“ a/s. 

For evaluation of the indirect effects of lightning to sensitive 
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aircraft electronics, it is necessary to consider both the multiple- 
stroke and multiple-burst environments, in addition to the basic 
indirect effects arising from Component A. This is because the 
succession of D/2 strokes or H pulses may induce corresponding 
pulses in data transfer circuits, for example, causing upset or 
cumulative damage to sensitive systems or devices, as noted previ- 
ously. 

7.3 c) ESTABLISH THE INTERNAL 
ENVIRONMENT 

A lightning strike injects a wide assortment of electric currents 
into the airframe, some of which reach hundreds of thousands of 
amperes. These currents diffuse throughout conducting structures 
and are accompanied by changing electromagnetic fields, which can 
also penetrate to the interior of the aircraft. 

TTie fields and structural IR voltages constitute the portion of the 
internal lightning environment which causes the voltages and cur- 
rents on interconnecting wiring that in turn appear at sensitive 
equipment interfaces. In some cases, electromagnetic fields within 
the aircraft may penetrate equipment enclosures and compromise 
system operation. 

The mechanisms whereby lightning currents and magnetic fields 
interact with electrical and electronic systems are illustrated in 
Figure 6. 



The passage of current between fuselage and engine nacelle 
creates a potential difference (voltage) between the flight deck and 
engine-mounted computer. In an aircraft constructed of conven- 
tional aluminum, resistance is primarily in the fuselage/wing, wing / 
pylon and pylon/engine joints. Whereas these resistances are small, 
lightning-stroke currents of 200 kA can produce IR voltages of 
several hundred volts. These structural IR voltages may drive 
currents into interconnecting wires between electronic components 
in the cockpit and nacelle. 

The lightning currents in the airframe are accompanied by 
changing magnetic fields which increase and decrease in amplitude 
along with the lightning current. A portion of these fields may 
penetrate through apertures in the fuselage, wing, pylon and nacelle 
and induce voltages in unshielded interconnected wiring or currents 
in the shields of shielded cables. 

The multiple-burst environment is not necessarily a salient factor 
in a damage assessment, but can be the primary factor in a system 
upset. Since major electrical/electronic systems are composed of 
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components that are distributed throughout the aircraft, verification 
of compliance relative to functional upset involves consideration of 
the overall lightning environment to which the system is exposed. 
Functional upset can be a particularly important issue for digital 
processor-based systems in modem aircraft. 

Determining the interior lightning environment is generally 
considered the responsibility of the airframe designer. However, 
sophisticated electronic control systems and equipment now being 
employed in aircraft, and the use of composite skins, necessitate a 
closer working relationship between the airframe designer and the 
equipment designer to fulfill the design goals of adequate lightning 
protection and aircraft performance and economy. 

Two methods are generally accepted in determining the internal 
environment: Numerical analysis, as described in detail in [15] and 
experimental analysis [16]. Numerical analysis methods, which are 
still in their relative infancy, are often validated by comparison with 
test data on simple airframes and/or wiring installations, and then 
extended to address more complex installations. 

The difficulty here is that in the extension, complex installations 
may introduce factors that affect computed results by at least one 
order of magnitude; yet these factors are not quantified and therefore 
neglected. Figure 7 shows the type of situation that can be analyzed, 
and a real-life installation this approach is sometimes intended to 
represent. 

Electromagnetic interference, from such sources as radio trans- 






mitters or radar systems, presents a different coupling mode than that 
of lightning. EMI, though present in the external environment, with 
the possibility of coupling with the internal environment, requires no 
special protection methods. An aircraft employing proper lightning 
protection methods will exclude adverse EMI effects. 

7.4 d) IDENTIFY THE FLIGHT- 
CRITICAL/ESSENTIAL SYSTEMS 
AND EQUIPMENT 

Flight-critical and essential systems and equipment include, but 
are not limited to: 

• Engine parameters 

• Wing anti-ice system 

• Aircraft power 

• Fuel-flow electrical 

• Flight instruments 

• Warning lights power 

• Stall barrier 

• Audible tone generator 

• Communication system(s) 

• Engine fire determination 

• Navigation capabilities 

In addition to identifying systems and equipment, a major consid- 
eration for the designer is to determine their locations and the routing 
of wiring within the aircraft and review the location of interfacing 
equipment which is not critical or essential but may provide an 
indirect (back door) for substantial lightning-induced transients. 
These transients may propogate from externally mounted probes or 
devices on the aircraft or be routed from regions with intense 
magnetic fields. 

Complex integrated avionic systems many times display avariety 
of functions of which some may be critical/essential, while other 
functions are only supplementary and, if lost, will not significantly 
degrade the level of safety. Failure or loss of certain noncritical and 
non-essential information may be acceptable as long as the critical/ 
essential functions are maintained. The identification of critical/ 
essential functions should be the determining factor for what systems 
or portions of a system must remain operable or no affected by the 
lightning event. 

The determination o f flight-critical/essential functions and equip- 
ment should be a formalized policy. Generally, it is best to have 
inputs into this list from not only system designers but from other 
support groups such as reliability (failure-mode analysis) groups and 
flight-test operations. This becomes veiy important since flight test 
may be required to demonstrate the ability to safely operate the 
aircraft from the critical/essential equipment list. Thus the critical 
and essential systems (or equipment) listing becomes a key certifi- 
cation issue which should be well conceived and agreed to by 
program management. 

7.5 e) ESTABLISH TCL AND ETDL 

The Transient Control Level philosophy was originally inspired 
by the Basic Insulation Level (BIL), or transient coordination 
philosophy, used successfully in the electric power field for many 
years. The TCL approach follows the BIL approach to transient 
coordination in that targets or specifications relative to transients 
should be assigned both to those who design electronic equipment 
and to those who design wiring to interconnect such equipment, 
rather than allowing things to develop by chance. The TCL philoso- 
phy is illustrated in Figure 8. 


equipment transient 

l susceptibility levels 
i i 



Interconnecting Electrical/ 
Wiring Electronic 
Equipment 


FIGURE 8 Relationships Between Transient Levels 


It encompasses the following: 

• Actual Transient Level: Ensuring that the actual transient level 
produced by lightning or any other source of transient will be less 
than that associated with the transient control level number assigned 
to the cable designer. The cable designer’s job is to analyze the 
electromagnetic threat that lightning would present and to use 
whatever techniques of circuit routing or shielding are necessary to 
ensure that the actual transients produced by lightning do not exceed 
the values specified for that particular type of circuit. 

• Equipment Transient Design Level: The ETDL establishes the 
levels of transients that must be tolerated by the equipment within a 
system. This tolerance can be achieved, of course, by inherent 
hardness or tolerance of the electronic devices within the equipment 
or by installation of surge-protection devices (SPDs) at the equip- 
ment terminals. The purpose of these SPDs is to limit incoming 
transients to levels that can be tolerated by equipment and compo- 
nents. 

Prediction of the actual transient levels during the system design 
phase is difficult because o f the large number o f individual wires and 
installation configurations that abound in any complex system. 
Therefore, there will always be apossibility of some wires or circuits 
experiencing higher transients than those which have been predicted 
by analysis during the design phase or even those which have been 
measured during tests of full vehicles. In the latter case, it is never 
practical to measure transients in every single wire due to time 
constraints. 

This topic of margins is very important, and one which the 
regulatory authorities have not formulated definite policies on. That 
is, the amount of the margin is uncertain in some cases. In general, 
the greater the degree of confidence that one has in the actual 
transient levels, the smaller the margin can be. Conversely, if actual 
transient levels, and therefore transient control levels, have been 
established purely by estimation or analysis techniques, or by 
similarity with other designs and not by test, then the authorities 
require use of a larger margin. 

Margins as small as 50 percent and as large as 10-1 have been 
required in the past. Recently, several advanced flight- and engine- 
control systems have been certified with a margin of 2-1 when the 
actual transient levels in interconnecting wires have been measured 
and verified by aircraft tests and when the capability of the equip- 
ment to tolerate the transient design levels have also been verified by 
test. 

Further discussion of recommended test techniques will appear in 
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Selection of the most appropriate method is challenging since it 
depends on the ultimate use of die data and the state of development 
ofthe aircraft. A simulationtechnique that imposes all features ofthe 
ligh tning in a proper time sequence is desirable but this may not be 
effective for subsystems or for providing design data. It is especially 
important that the simulation technique provide data on the system, 
subsystem or component equipment on line replaceable unit (LRU) 
responses that can be extrapolated to the values that occur when the 
aircraft is exposed to the real lightning environment. 

Transient design and control levels are best defined in terms ofthe 
waveshapesand amplitudes of induced voltage and current transients 
that appear at interfaces between equipment and interconnecting 
wires. Specifically, this means the transients that appear on equip- 
ment connector pins. In most cases, lightning strikes will induce the 
maximum levels of transients between interconnecting wires and 
airframe ground. Therefore, the maximum induced transients will 
nearly always appear between connector pins and case ground. Thus 
it is usually preferable to design the equipment transient design 
levels as the levels of transients that must be withstood by the 
equipment between incoming connector pins and equipment case 
ground. 

This is often referred to as a pin specification. Of course, in any 
complex system there will be many wires and pins interfacing with 
each piece of equipment. These wires will extend to varied locations 
within the aircraft and will experience varying amplitudes and 
waveshapes of transients. In addition, these circuits may themselves 
operate at a different or varied system voltage levels. For example, 
some incoming wires bring 115 V or 28V aircraft power to the 
equipment. Others, however, only transmit very small signal volt- 
ages whose amplitudes do not exceed 1 V or 5 V. Thus it often makes 
sense to establish more than one transient design level for a single 
piece of equipment with the individual levels being related to either 
the function of the incoming circuit and connector pin or the routing 
of that circuit through the aircraft. 

Thus, for example, for a typical flight-control computer, one 
transient design level could be established for incoming 1 1 5V AC 
power circuits, a second level might be established for incoming 28V 
DC aircraft power circuits, and a third equipment transient desip 
level could be established for incoming or outgoing sipal and 
control circuits. 

Frequently, each of these functions passes through the same 
multi-pin connector. In this example, a single connector can have 
pins which must withstand differing equipment transient desip 
levels. 

But in all cases, the levels would be defined as follows: 

• A waveshape 

• A peak voltage 

• A peak current 

The voltage referred to above is the maximum voltage which 
would be expected to appear at the open-circuit terminals of the 
interfacing wire with no load. This is referred to as the open-circuit 
voltage as shown in Figure 9 (a). The current specification is the 
maximum current expected to be induced in the same interconnect- 
ing circuits) when that circuit is shorted to pound at the equipment 
as in Figure 9 (b). Of course, in most cases, the load within the 
equipment is a finite impedance, so that neither the open-circuit 
voltage nor the short-circuit current will appear at the equipment in 
an actual lightning strike event as shown in Figure 9 (c). But if the 
transient desip level specification is described in this manner, then 
the proper amplitude of transient will appear at the equipment when 



the equipment is tested with a test set that can also produce either the 
open-circuit voltage or the short-circuit current. 

7.5.1 CONSIDERATIONS IN ETDL SELECTION 

The importance of ETDLs applicable to the equipment connector 
pins is that it establishes the transient levels which equipment 
components must withstand without burnout. This is the very basic 
and most important part ofthe ETDL specification for flight critical 
and essential equipment. Compliance with pin specifications will 
require proper selection of equipment components and/or the appli- 
cation of surge-suppression devices. A further discussion of protec- 
tion devices is contained in Design Protection section of this paper. 

Verification of compliance with pin ETDL requirements usually 
means the application of a pin-injection test as described in [1 ]. In 
this test, transients are applied to pins individually. This means that 
the equipment cannot be interconnected with other equipment on the 
test bench. A pin specification and pin-injection test are not capable 
of evaluating the synergistic effects that may occur due to the 
simultaneous application oftransients on all incoming circuits andat 
all connectors within the system. It is therefore usually necessary to 
specify a second type of ETDL which is applicable to a fUlly 
interconnected and operating system. 

This second ETDL is often a bulk cable current specification 
which defines the waveshape and amplitude of the total current 
expected to be induced in the cables which interconnect the various 
components of the system, such as those which connect the flight- 
control computer to secondary actuators in a flight-control system. 
For this purpose, a bulk cable current waveshape, such as waveform 
1 or 5, as shown in AC 20-136 is often selected together with a peak 
amplitude. Amplitudes of bulk cable currents induced on intra- 
engine cables of a full-authority digital engine control system would 
range in the thousands of amperes, whereas the amplitudes of bulk 
cable currents circulating in cables installed within an aluminum 
fuselage might be less than 100 amperes. 

Bulk cable current specifications are most appropriate for cables 
in which the bundle of wires in enclosed within an overall shield or 
in which most of the circuits are enclosed within individual shields, 
and these shields are grounded to equipment cases at each end. In this 
case, of course, the lightning magnetic fields induce voltages and 




currents in the loop between the cable shields and the airframe. In 
some cases, cables may not simply extend between two pieces of 
equipment but may branch and extend from one piece of equipment 
such as a computer to several remote items such as actuators and 
sensors. In these cases, care must be given to selection of realistic 
current levels. For example, the bulk cable current at the computer 
end of such a cable would be the sum of the bulk cable currents 
entering each of the accessories which are fed from branches of this 
same cable. 

The bulk cable current specification is viewed as a system 
specification, both from a component-damage and system-upset 
perspective. Cable shields, connectors, equipment cases and compo- 
nents within the equipment must, of course, withstand the effects of 
the specified currents flowing on the cable shields. Currents on 
shields will, of course, produce transient voltages in conductors and 
at equipment interfaces within those shields. These transients will be 
lower in amplitude than they would be were the shields not present 
or ungrounded. Nonetheless, these transients still exist and in some 
cases may reach damaging levels. Also, induced transients which do 
not meet damaging levels may still be capable of upsetting digital- 
processing circuits, especially when it is recalled that there will be 
more titan one transient produced by an individual lightning flash. 
The bulk cable current specification therefore enables realistic 
induced transients to be induced simultaneously in all cables and 
conductors within a system. And if for verification purposes this 
ETDL is applied in a multiple-stroke or multiple-burst mode, it is 
indeed possible to evaluate system upset possibilities and/or verify 
that the system will not upset when exposed to the specified ETDL. 

For interconnecting cables which are not shielded it may not be 
appropriate to specify a bulk cable current or at least a bulk cable 
current by itself. In these cases, the cable ETDL may be specified as 
both an open-circuit voltage and a short-circuit current. In this case, 
the open-circuit voltage is the voltage that would appear between the 
ends of all interconnecting wires and airframe ground when discon- 
nected from the equipment. The short-circuit current factor is the 
total current that would flow from all connectors to airframe ground 
when these connectors are shorted to airframe ground at the equip- 
ment. Thus in this latter case the short-circuit current factor can be 
viewed as the sum of the short-ciurcuit currents in all the individual 
wires within the cable bundle. 

7.5.2 OTHER ASPECTS OF ETDL 
SPECIFICATIONS 

It must be remembered that whereas ETDLs are defined as a 
single waveform, they do appear as multiple transients because of the 
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fact that lightning flashes inject more than one stroke or pulse of 
current through the airframe with each stroke or current pulse 
producing a corresponding transients. This aspect of the lightning 
environment has been defined as the multiple-stroke and multiple- 
burst environment in AC 20-136. Therefore whenever at ETDL is 
defined, it must be viewed as a multiple-transient threat as illustrated 
in Figure 10. 

The first of these pulses is at the specified ETDL level and the 
second through the 24th of which are either at one-half or one-fourth 
of the specified ETDL depending upon the coupling mode. Subse- 
quent transients which are predominantly due to changing magnetic 
fields would be one-half of the original ETDL. Transients which are 
predominantly due to structural IR effects are one-fourth of the 
amplitude of the original ETDL. 

Thus the equipment components must be designed and verified to 
withstand the first ETDL transient but the subsequent 23 transients 
at reduced levels. Test and analysis methods for verification and 
compliance with this multiple-stoke specification are discussed 
more fully in [1]. 

Damaging effects of the subsequent stroke components of the 
multiple-stroke environment are significant and do need to be 
accounted for in equipment design and in the selection of surge- 
protection devices which will be discussed in the following section. 

The damaging effects of multiple-burst transients are usually 
negligible andneednot be considered in selection of circuit elements 
or SPDs. However, the multiple-burst transients are important from 
an upset standpoint. 

7.5.3 PITFALLS IN ETDL SELECTION 

One method of defining ETDL for system equipment has been to 
define the characteristics of a transient which is applied between an 
equipment case and a test bench ground when that case has been 
elevated from ground. In this case, a short cable(s) is attached to the 
equipment and grounded through simulated loads a short distance 
away from the equipment. Verification is achieved by applying the 
specified transient between the equipment case and test bench 
ground. Unfortunately, one cannot be certain of the value of the 
levels of actual transients applied to specific pins or electronic 
devices within the equipment because in most cases there exist one 
or more ground wires or grounded shields between the equipment 
and the simulated loads a short distance away. 

These wires inevitably accept most of the transient energy and 
leave the remaining conductors relatively unexposed. Unfortu- 
nately, the method just described has been formalized in several 
industry specification and test requirements, including RTCA DO- 
1 60, [1 8] and many equipment vendors have received the misleading 
impression that compliance with such a specification indicates that 
their equipment can indeed tolerate an ETDL at its interface(s) as 
described earlier in this section. 

Nothing could be further from the truth. Also, unfortunately, 
potential users of such equipment have been led astray and given the 
false assumption that equipment thus qualified is capable of tolerat- 
ing actual transient levels that appear between individual wires and 
airframe ground. Fortunately, industry standards-writing groups are 
taking a second look at these methods and clarifying the results 
obtained from them as compared with the pin specification. 

Flow charts demonstrating logical progression of steps toward 
integration of design at the airframe and component levels are shown 
in Figure 1 1. 
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FIGURE 11 Integration of Design to Airframe 


7.6 f) DESIGN PROTECTION 

T o minimize the possibility of upset or damage, the ETDL should 
be higher than the TCL allowed to appear at equipment interfaces. In 
cases where the TCL plus the defined margin exceed the transient 
design level, additional protection must be provided. The optimum 
protection design is based on many factors, including level of 
required and provided protection, cost, weight, impact on production 
schedule, impact on vehicle performance, maintenance, reliability 
and ability to withstand other natural and man-made environments. 

In general, the objective of the protection design is to: 

• Reduce the level of the transient that reaches the vulnerable 
electric or electronic circuit. 

• Decrease vulnerability o f the circuits by increasing their damage 
and upset thresholds. 

• Increase the design margin by combining elements ofthe above. 

Design techniques commonly used to reduce transient levels 

include shielding, cable routing, circuit wiring type selection, termi- 
nal protection and dielectric isolation. Techniques that decrease 
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circuit vulnerability include circuit designs with high damage levels, 
high-level logic, and use of hardware and software techniques to 
increase circuit upset tolerance. 

In order to make an electronic system immune to the effects of 
lightning, it is almost always necessary to make judicious use of 
shielding on interconnecting wiring and to provide proper grounding 
of these shields. 

Of the different types of shields, the solid shield inherently 
provides better shielding than does a braided shield, and a spiral- 
wrapped shield can be far inferior to a braided shield in performance. 

In severe environments, braided shields using two overlapping 
courses of braid may give shielding performance approaching that of 
a solid-walled shield. 

Conduits should not be relied upon for protection against indirect 
effects since they may or may not provide electromagnetic shielding. 
Only if the conduit is electrically connected to the aircraft structure 
will it be able to carry current, and thus provide shielding for the 
conductors within. 

The presence of a shield grounded at only one end will not 
significantly affect the magnitude of the voltage induced by chang- 
ing magnetic fields, although a shield may protect against changing 
electric fields. While a shield may keep the voltage at the grounded 
end low, it will allow the common mode voltage on the signal 
conductors to be high at the unshielded end. 

Shielding againstmagnetic fields requires the shieldtobe grounded 
at both ends, in order that it may carry a circulating current. It is the 
circulating current that cancels the magnetic fields that produce 
common mode voltages. 

There is some virtue in staggering spacing between multiple- 
ground points on a cable shield, since it is theoretically possible that 
uniform grounding can lead to troublesome standing waves if the 
shield is illuminated by a sustained frequency interference source. 
Also, the cable may be exposed to a significant amount of magnetic 
field over only a small portion of its total length. If the shield is 
multiple-grounded, the circulating currents will tend to flow along 
only one portion of the cable, whereas if it is grounded at only the two 
ends, current is constrained to flow the entire length of the cable. 

The requirement that a shield intended for protection against 
lightning effects must be grounded at both ends raises the perennial 
controversy about single-point versus multi-point grounding of 
circuits. For many reasons, mostly legitimate, low-level circuits 
need to be shielded against low-frequency interference. Most com- 
monly, and usually legitimately, the shields intended for such low- 
frequency interference protection are grounded at only one end. 

A fundamental concept, often overlooked is that the physical 
length of such shields must be short compared to the wavelength of 
the interfering signals. Lightning-produced interference, however, is 
usually broad-band and includes significant amounts of energy at 
quite high frequencies - frequencies higher than those the typical 
low-frequency shields are intended to handle. This conflict is usually 
too great for both sets of requirements to be met by only one shield 
system. 

Most commonly, both sets of requirements can be met only by 
having one shield system to protect against low-frequency interfer- 
ence and a second to protect against lightning-generated interfer- 
ence. The lightning shield can usually consist of an overall braided 
shield on a group of conductors, with this overall shield being 
grounded to the aircraft structure at least at the ends. Within the 
overall shield may be placed whatever types of circuits are needed. 
Such an overall shield is shown in Figure 12. Other types of 
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grounding for shields are shown in Figure 13. 

An in-depth treatment of equipment location and associated 
wiring can be found in [17]. 

Because of other constraints, the designer may not have much 
choice in the location of electronic equipment. But it is often possible 
to make improvements in the resistance to indirect effects by locating 
equipment in regions of the aircraft where the electromagnetic fields 


• The closer a conductor is placed to a metallic ground plane, the 
less is the flux that can pass between that conductor and the ground 
plane. 

• Magnetic fields are concentrated around protruding structural 
members and diverge in inside comers. Hence, conductors located 
atop protruding members will intercept more magnetic flux than 
conductors placed in comers, where the field intensity is weaker. 

• Fields will be weaker on the interior of a U-shaped member than 
they will be on the edges of that member. 

• Fields will be lowest inside a closed member. 

Circuit protection devices can sometimes be used to limit the 
amount of electrical energy that a wire can couple into a piece of 
electronic equipment. While one can seldom eliminate interference 
through the use ofcircuit protection devices, when judiciously used, 
they can virtually eliminate physical damage to electronic devices. 
Protective devices should be incorporated into a piece of equipment 
at the time it is built, not added after trouble has been experienced. 

Circuit protection devices, described in [19] include: 

• Switching devices 

• Non-linear devices 

• Circuit interrupters 

• Spark gaps 

• Metal oxide varistors 

• Zenar-type diodes 

• Reverse-biased diodes 

Frequently a spark gap and a MOV, or an MOV and a surge- 
protecting diode, are used together to provide added protection. The 
higher energy device is connected close to the point where the surge 
may enter the system, and the lower energy device is connected close 
to the more sensitive components. The principle is that the high- 
energy device provides the primary protection and diverts the maj or 
portion of the surge energy, while the lower-energy device provides 
protection for the residual transients. 

Protective devices cannot be operated directly in parallel since 
the device with the lowest clamping voltage would carry all the surge 
current. Impedance between the two is needed to limit the surge 
current in the lower energy device and allow voltage to develop that 
initiates conduction in the high-energy device. Best protection is 
obtained if the two surge protectors are physically separated, where 
possible. 


produced by lightning current are the lowest, and by avoiding 
placement in the region where fields are the highest. For example, 
since the most important type of coupling from the outside electro- 
magnetic environment to the inside of the aircraft is through aper- 
tures, it follows that equipment should be located as far from major 
apertures as possible. 

One main goal is to locate electronic equipment toward the center 
of the aircraft structure, since the electromagnetic fields tend to 
cancel toward the center of any structure. Other goals include 
locating equipment away from the outer skin o f the aircraft, particu- 
larly the nose; and, if possible, electronic equipment should be 
located in shielded compartments. 

Of particular importance to aircraft using large amounts of 
composite materials is the type of shelf upon which electronic 
equipment is located. Shelves are called upon to provide ground 
planes or reference surfaces for electronic equipment, and thus it is 
essential that they be highly conductive and well-bonded to the 
aircraft structure. 

Some basic principles apply: 
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One of the most important considerations in the control of 
lightning-related interference through proper circuit design lies in 
the fundamental observation that a device with a broad bandwidth 
can intercept more noise energy than can anarrow bandwidth device. 
Some of the considerations that derive from this observation are 
contained in Figure 14. 

The noise produced by lightning has a broad frequency spectrum. 
Equipment is damaged or caused to malfunction in accordance with 
the total amount of energy intercepted. In a lightning flash there may 
be plenty of energy left in the megahertz and multimegahertz region 
to cause interference. The energy that is available for damage or 
interference may well be concentrated in certain frequency bands by 
the characteristic response of the aircraft or the wiring within the 
aircraft. 

The studies of types of interference produced in aircraft by the 
flow of lightning current have shown that the lightning energy 
excites oscillatory frequencies on aircraft wiring, particularly if the 
wiring is based on the single-point grounding concept. If at all 
possible, the pass bands of electronic equipment should not include 
these frequencies, as does the hypothetical pass band shown in Figure 
14 (d). Higher or lower pass bands would inherently be better than the 
one shown. As an extreme example, shown in Figure 14 (e) fiber 
optic signal transmission operating in the infrared region avoids the 
frequency spectrum associated with lightning-generated interfer- 
ence almost completely. 

Once the ETDLs have been established, it is important to look at 
the protection design of individual equipment from a system stand- 
point when possible, and some intelligent decisions can be made. 

If a system is protected on an independent basis where SPDs are 
installed at each end of a circuit, there is the potential for burning out 



the SPDs at both ends of the circuit. Therefore, placing SPDs at 
interfaces of all LRUs within a system is not always a good idea. It 
adds weight and cost to the equipment. Instead, there are several 
alternatives which make sense from a system design standpoint. One 
is applying an SPD at one end of a circuit and utilizing electrical 
insulation between incoming elements and case ground at the other 
end, as illustrated in Figure 15. 

Because of that insulation, no current flows. Because no current 
flows, no current flows through SPDs at the computer end and they 
are not stressed. The SPDs are there in the rare event that a transient 
might appear there, but they are not stressed by short-circuit currents 
because the remote ends of the circuit conductors are insulated from 
ground. 

A variation consists of SPDs used at the computer as before. 
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When complete insulation is not possible in the remote LRUs, it is 
possible to install series impedance at the interfaces of the remote 
LRU. Thus, in this particular case, some current will flow in the 
circuit, but the current will be limited by the series resistance to a 
level which is safe enough so that SPDs in the computer do not bum 
out. 

When either of these two approaches is employed for protection 
design, it is essential that both LRUs be assigned the same ETDL and 
that both be verified by test, specifically by the pin-injection test 
described earlier and which will be discussed further in [ 1 ]. When the 
pin-injection test is applied to the computer interface, the open- 
circuit voltage of the test set will be clamped to the rated clamping 
level ofthe SPDs in the computer and current will flow through them. 
This current will be limited by the short-circuit current factor in the 
ETDL specification and, of course, the SPDs must be able to tolerate 
this amount of short-circuit current to pass the test. At the remote 
LRU, the same test set is applied to the connector pins of the same 
circuit. In this case, the entire test set voltage which is the ETDL 
open-circuit voltage level, will appear between incoming pins and 
case ground because there are no SPDs and no other elements or 
connections between incoming circuits and case ground. Thus the 
insulation between LRU circuit elements and case ground must be 
capable of tolerating the full ETDL voltage level. 

A major challenge facing FADEC and FBW system designers 
concerns the performance of system software in the presence of 
indirect lightning effects. [20], [21], [22], [23]. Circuits should be 
designed to tolerate momentary logic upsets and to return to normal 
operation after a transient. Designers should avoid circuits that latch 
up in an abnormal mode, and use logic with high transitional levels 
wherever possible. 

In a practical sense, upset is very difficult to prevent by shielding 
because the signal levels must be reduced to below the level of the 
logic voltage (usually a very low signal of 5 to 12V). Protection 
devices cannot be used because the devices, if they are set below the 
logic level, would effectively upset the logic. Upset hardening is 
often handled by software that allows the upset to occur but ensures 
that it will not be catastrophic to the aircraft or its operation. Optical 
isolation equipment is effective in reducing upset. 

Following are a few examples of the software techniques that 
should be considered to minimize upset: 

• Program execution from random access memory (RAM) is 
undesirable. 

• Exit from temporary loops must be guaranteed. 

• Return from all possible interrupts is mandatory. 

• Use system cross-checking and process redundancy that in- 
volves multiple execution of a process and comparison of results. 

• Use checkpoint rollback where critical information is periodi- 
cally and routinely recorded on a backup or redundant-storage 
medium. 

• Use plausibility checks that verify that information being 
processed or the result of computation fall within realistic bounds. 

• Use timeouts for certain operations to occur. 

8.0 CONCLUSION 

This paper has discussed the first six steps in the lightning 
protection certification process. The sequel paper, “Certification of 
Lightning Protection for a Full-Authority Digital Engine Control,” 
discusses the verification process in detail. 
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